Live › vulnerability › GHSA-79qw-g39g-mfxc
This advisory is a withdrawn duplicate of GHSA-f5p5-6xmx-p252. The original text says any logged-in user can bypass role, scope and UMA permission checks in Keycloak Policy Enforcer by putting the access-denied page path in a request URL.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:39 UTC. All times on this page are UTC.
Teams running Keycloak with the Policy Enforcer and access-denied page configured, where authenticated users reach protected resources. The sources list affected ranges below 26.6.4 for keycloak-services and below 26.0.10 for keycloak-policy-enforcer. Teams not using Policy Enforcer can likely skip it, but the sources do not say.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.6.4 | – |
| org.keycloak:keycloak-policy-enforcer | maven | < 26.0.10 | – |
org.keycloak:keycloak-services and org.keycloak:keycloak-policy-enforcerorg.keycloak:keycloak-services: fixed version unknown (sources list affected below 26.6.4)org.keycloak:keycloak-policy-enforcer: fixed version unknown (sources list affected below 26.0.10)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-f5p5-6xmx-p252. This link is maintained to preserve external references.
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
This page as .md · .json · in your agent: get_signal("GHSA-79qw-g39g-mfxc")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.